Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 08:13

General

  • Target

    -pril-main/ptjjsekfthse.exe

  • Size

    631KB

  • MD5

    4d95ea8721d0a84b69c2d60951a8a65e

  • SHA1

    b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c

  • SHA256

    1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d

  • SHA512

    7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee

  • SSDEEP

    12288:Cr2N7ewZcHjHkoP19jpVgUbdxGU2NjCa8UQGqIJ7uHXNI8W2Zx:Cr2EEypVg4x8NmtjS+

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe
    "C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6xPpo26MbF.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3132
        • C:\Users\Admin\AppData\Local\ptjjsekfthse.exe
          "C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4688
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "ptjjsekfthsep" /sc MINUTE /mo 11 /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4036
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "ptjjsekfthse" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3404
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "ptjjsekfthsep" /sc MINUTE /mo 7 /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4892

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ptjjsekfthse.exe.log

      Filesize

      1KB

      MD5

      7800fca2323a4130444c572374a030f4

      SHA1

      40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

      SHA256

      29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

      SHA512

      c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

    • C:\Users\Admin\AppData\Local\Temp\6xPpo26MbF.bat

      Filesize

      211B

      MD5

      5ba54ae4bf6ca0d1874fad695a13622b

      SHA1

      2aa44253c2f0d3891d0d076c080feb37b38c1a64

      SHA256

      97a298f2639c89c176cb408845367f1f69a5d45b038b028c204214c81c7e4c0b

      SHA512

      be0c526fe9160619498e63c66d644a2934dea003d0a2ee1715d5be9a04b38de76be2a46a77339c0de5e204d346f77b1bef02ac4fa1f7f2dbfcc4b2c7a12f5756

    • C:\Users\Admin\AppData\Local\ptjjsekfthse.exe

      Filesize

      631KB

      MD5

      4d95ea8721d0a84b69c2d60951a8a65e

      SHA1

      b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c

      SHA256

      1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d

      SHA512

      7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee

    • memory/2796-0-0x00007FFE2DE13000-0x00007FFE2DE15000-memory.dmp

      Filesize

      8KB

    • memory/2796-1-0x0000000000940000-0x00000000009E4000-memory.dmp

      Filesize

      656KB

    • memory/2796-2-0x00007FFE2DE10000-0x00007FFE2E8D1000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-3-0x0000000001360000-0x000000000137C000-memory.dmp

      Filesize

      112KB

    • memory/2796-4-0x000000001B5A0000-0x000000001B5F0000-memory.dmp

      Filesize

      320KB

    • memory/2796-5-0x0000000002C40000-0x0000000002C56000-memory.dmp

      Filesize

      88KB

    • memory/2796-13-0x00007FFE2DE10000-0x00007FFE2E8D1000-memory.dmp

      Filesize

      10.8MB